Proofpoint researchers have been tracking numerous small Dridex campaigns over the past few months, as well as a mid-sized campaign this week that point not to the displacement of Dridex by Locky but rather far more targeted distribution of the infamous banking Trojan, as well as potential impact in new geographies.

Proofpoint and Trend Micro researchers collaborated to detect and analyze a sophisticated, previously undocumented malvertising campaign that exposed millions of users every day to attacks that employed steganography and multi-layered filtering.